<!DOCTYPE html>
<html>

<head>
	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
	<meta name="theme-color" content="#33474d">
	<title>DNS服务器(四)：DNS视图及bind中rndc的使用 | 失落的乐章</title>
	<link rel="stylesheet" href="/css/style.css" />
	
      <link rel="alternate" href="/atom.xml" title="失落的乐章" type="application/atom+xml">
    
</head>

<body>

	<header class="header">
		<nav class="header__nav">
			
				<a href="/archives" class="header__link">Archive</a>
			
				<a href="/tags" class="header__link">Tags</a>
			
				<a href="/atom.xml" class="header__link">RSS</a>
			
		</nav>
		<h1 class="header__title"><a href="/">失落的乐章</a></h1>
		<h2 class="header__subtitle">技术面前，永远都是学生。</h2>
	</header>

	<main>
		<article>
	
		<h1>DNS服务器(四)：DNS视图及bind中rndc的使用</h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/DNS/">DNS</a>
			</span>
		
	</div>

	

	
		<h2 id="一、DNS服务器视图功能的实现"><a href="#一、DNS服务器视图功能的实现" class="headerlink" title="一、DNS服务器视图功能的实现"></a>一、DNS服务器视图功能的实现</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;DNS服务器有一个高级的功能，能够实现不同的用户访问同一个域名，把域名解析成不同的IP地址，使用户能够访问离他最近的服务器上的数据，这就是DNS服务器的视图功能。使用DNS服务器的视图功能可以增加网站的响应速度。例如，当我们网站的数据同步在两台web服务器上时，一台是电信服务器，一台是网通服务器，那么我们肯定希望全国访问我们网站的用户在打开网站的时候，能够自动实现，电信用户访问电信服务器，网通用户访问网通服务器。配置这种情况的前提是，web服务器必须要有一个电信的IP地址和一个网通的IP地址。DNS服务器的这种解析功能通常也被称之为智能解析。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;DNS服务器的视图通常在配置文件中是使用view实现的。把要使用某些IP地址作单独访问的zone区域，统一放在一个命名的view段落中，并且在view中定义请求的IP地址或IP地址段，把IP地址写入match-clients选项中。如果像上面说的，区分电信和网通路线的话，那么可以使用两个acl访问控制列表写上电信或网通IP地址，定义电信网通路线，把acl名字写入view段落match-clients选项中。如下所示：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div><div class="line">21</div><div class="line">22</div><div class="line">23</div></pre></td><td class="code"><pre><div class="line">acl telecomip&#123; tele_IP; ... &#125;;</div><div class="line">acl netcomip&#123; net_IP; ... &#125;;</div><div class="line">view telecom &#123;</div><div class="line"> match-clients &#123; telecomip; &#125;;</div><div class="line"> zone <span class="string">"ZONE_NAME"</span> IN &#123;</div><div class="line"> <span class="built_in">type</span> master;</div><div class="line"> file <span class="string">"ZONE_NAME.telecom"</span>;</div><div class="line"> &#125;;</div><div class="line">&#125;;</div><div class="line">view netcom &#123;</div><div class="line"> match-clients &#123; netcomip; &#125;;</div><div class="line"> zone <span class="string">"ZONE_NAME"</span> IN &#123;</div><div class="line"> <span class="built_in">type</span> master;</div><div class="line"> file <span class="string">"ZONE_NAME.netcom"</span>;</div><div class="line"> &#125;;</div><div class="line">&#125;;</div><div class="line">view default &#123;</div><div class="line"> match-clients &#123; any; &#125;;</div><div class="line"> zone <span class="string">"ZONE_NAME"</span> IN &#123;</div><div class="line"> <span class="built_in">type</span> master;</div><div class="line"> file <span class="string">"ZONE_NAME.netcom"</span>;</div><div class="line"> &#125;;</div><div class="line">&#125;;</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;需要注意的是：</p>
<ul>
<li>如果使用了视图的功能，那么配置文件中的所有zone区域都要必须写在视图里面，如，配置文件里默认要配置的三个区域，根、127.0.0.1、1.0.0.127.in-addr.arpa都要写入视图。</li>
<li>在acl中定义IP地址，IP地址的写法可以是单个IP地址也可以是一个IP地址段加掩码，如：192.168.0.0/24。</li>
<li>视图是根据配置文件从上往下匹配的，所以希望优先访问的资源记录文件，区域应该尽量写前面。</li>
<li>如果定义的若干个视图的IP地址不全的话，那么可以在最后定义一个默认视图，match-clients选项中的IP地址写上any，代表如果此次访问的IP地址上面没有一个能匹配到，则在此处归类。</li>
</ul>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;实例：虚拟两台IP地址不同的主机，实现DNS服务器视图功能。</p>
<ol>
<li>本地电脑只有一个IP地址段，故使用两个IP地址分别代表两个不同的路线。首先，我们配置一个区域wubinary.com的DNS服务器，ip地址为,192.168.0.6。打开/etc/named.rfc1912.zones文件，编辑如下：</li>
</ol>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div><div class="line">21</div><div class="line">22</div><div class="line">23</div><div class="line">24</div><div class="line">25</div><div class="line">26</div><div class="line">27</div><div class="line">28</div><div class="line">29</div><div class="line">30</div><div class="line">31</div><div class="line">32</div><div class="line">33</div><div class="line">34</div><div class="line">35</div><div class="line">36</div><div class="line">37</div><div class="line">38</div><div class="line">39</div><div class="line">40</div><div class="line">41</div><div class="line">42</div><div class="line">43</div><div class="line">44</div><div class="line">45</div><div class="line">46</div><div class="line">47</div><div class="line">48</div><div class="line">49</div><div class="line">50</div><div class="line">51</div><div class="line">52</div></pre></td><td class="code"><pre><div class="line">acl net &#123; 192.168.0.6; &#125;;</div><div class="line">acl <span class="built_in">local</span> &#123; 192.168.0.12; &#125;;</div><div class="line">view netcom &#123;</div><div class="line">match-clients &#123; net; &#125;;</div><div class="line">zone <span class="string">"."</span> IN &#123;</div><div class="line"><span class="built_in">type</span> hint;</div><div class="line">file <span class="string">"named.ca"</span>;</div><div class="line">&#125;;</div><div class="line">zone <span class="string">"localhost.localdomain"</span> IN &#123;</div><div class="line"><span class="built_in">type</span> master;</div><div class="line">file <span class="string">"named.localhost"</span>;</div><div class="line">allow-update &#123; none; &#125;;</div><div class="line">&#125;;</div><div class="line">zone <span class="string">"localhost"</span> IN &#123;</div><div class="line"><span class="built_in">type</span> master;</div><div class="line">file <span class="string">"named.localhost"</span>;</div><div class="line">allow-update &#123; none; &#125;;</div><div class="line">&#125;;</div><div class="line">zone <span class="string">"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa"</span> IN &#123;</div><div class="line"><span class="built_in">type</span> master;</div><div class="line">file <span class="string">"named.loopback"</span>;</div><div class="line">allow-update &#123; none; &#125;;</div><div class="line">&#125;;</div><div class="line">zone <span class="string">"1.0.0.127.in-addr.arpa"</span> IN &#123;</div><div class="line"><span class="built_in">type</span> master;</div><div class="line">file <span class="string">"named.loopback"</span>;</div><div class="line">allow-update &#123; none; &#125;;</div><div class="line">&#125;;</div><div class="line">zone <span class="string">"0.in-addr.arpa"</span> IN &#123;</div><div class="line"><span class="built_in">type</span> master;</div><div class="line">file <span class="string">"named.empty"</span>;</div><div class="line">allow-update &#123; none; &#125;;</div><div class="line">&#125;;</div><div class="line">zone <span class="string">"wubinary.com"</span> IN &#123;</div><div class="line"><span class="built_in">type</span> master;</div><div class="line">file <span class="string">"wubinary.com.net"</span>;</div><div class="line">&#125;;</div><div class="line">&#125;;</div><div class="line">view localcom &#123;</div><div class="line">match-clients &#123; <span class="built_in">local</span>; &#125;;</div><div class="line">zone <span class="string">"wubinary.com"</span> IN &#123;</div><div class="line"><span class="built_in">type</span> master;</div><div class="line">file <span class="string">"wubinary.com.local"</span>;</div><div class="line">&#125;;</div><div class="line">&#125;;</div><div class="line">view default &#123;</div><div class="line">match-clients &#123; any; &#125;;</div><div class="line">zone <span class="string">"wubinary.com"</span> IN &#123;</div><div class="line"><span class="built_in">type</span> master;</div><div class="line">file <span class="string">"wubinary.com.local"</span>;</div><div class="line">&#125;;</div><div class="line">&#125;;</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;说明：我们分别定义两个acl，用于代表两个不同路线，IP地址为192.168.0.6的机器访问的资源记录文件是 wubinary.com.net文件，IP地址为192.168.0.12和其它的机器则访问wubinary.com.local这个文件的资源记录文件。</p>
<ol>
<li>分别编辑这两个文件</li>
</ol>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;编辑文件/var/named/wubinary.com.net</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/DNS%E6%9C%8D%E5%8A%A1%E5%99%A8(%E5%9B%9B" alt=""></figure>%EF%BC%9ADNS%E8%A7%86%E5%9B%BE%E5%8F%8Abind%E4%B8%ADrndc%E7%9A%84%E4%BD%BF%E7%94%A8/01.jpeg?raw=true)</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;编辑文件/var/named/wubinary.com.local</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/DNS%E6%9C%8D%E5%8A%A1%E5%99%A8(%E5%9B%9B" alt=""></figure>%EF%BC%9ADNS%E8%A7%86%E5%9B%BE%E5%8F%8Abind%E4%B8%ADrndc%E7%9A%84%E4%BD%BF%E7%94%A8/02.jpeg?raw=true)</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;这里IP地址分别改了，192.168.0.6的机器请求时对应解析的IP是192.168开头的，192.168.0.12请求时对应解析的IP是172.16开头的。配置完成后，记得修改文件所属组及文件权限。</p>
<ol>
<li>测试一下配置文件语法。</li>
</ol>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/DNS%E6%9C%8D%E5%8A%A1%E5%99%A8(%E5%9B%9B" alt=""></figure>%EF%BC%9ADNS%E8%A7%86%E5%9B%BE%E5%8F%8Abind%E4%B8%ADrndc%E7%9A%84%E4%BD%BF%E7%94%A8/03.jpeg?raw=true)</p>
<ol>
<li>好的，重新载入配置文件，在分别在两台机器上测试一下吧。</li>
</ol>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;重载配置文件：</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/DNS%E6%9C%8D%E5%8A%A1%E5%99%A8(%E5%9B%9B" alt=""></figure>%EF%BC%9ADNS%E8%A7%86%E5%9B%BE%E5%8F%8Abind%E4%B8%ADrndc%E7%9A%84%E4%BD%BF%E7%94%A8/04.jpeg?raw=true)</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;192.168.0.6的机器，也就是我们DNS所属的这台机器，结果如下：</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/DNS%E6%9C%8D%E5%8A%A1%E5%99%A8(%E5%9B%9B" alt=""></figure>%EF%BC%9ADNS%E8%A7%86%E5%9B%BE%E5%8F%8Abind%E4%B8%ADrndc%E7%9A%84%E4%BD%BF%E7%94%A8/05.jpeg?raw=true)</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;192.168.0.12的机器，结果如下：</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/DNS%E6%9C%8D%E5%8A%A1%E5%99%A8(%E5%9B%9B" alt=""></figure>%EF%BC%9ADNS%E8%A7%86%E5%9B%BE%E5%8F%8Abind%E4%B8%ADrndc%E7%9A%84%E4%BD%BF%E7%94%A8/06.jpeg?raw=true)</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;两台机器请求DNS服务器时域名解析达到了预期的效果，测试成功。</p>
<h2 id="二、bind中rndc的使用"><a href="#二、bind中rndc的使用" class="headerlink" title="二、bind中rndc的使用"></a>二、bind中rndc的使用</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;rndc是Remote Name Domain Controllerr的简写，它是一个远程管理bind的工具。在使用rndc管理bind前需要使用rndc生成一对密钥文件，一半保存于rndc的配置文件中，另一半保存于bind主配置文件中。rndc的配置文件为/etc/rndc.conf，在CentOS或者RHEL中，rndc的密钥保存在/etc/rndc.key文件中。rndc默认监听在953号端口，其实在bind9中rndc默认就是可以使用可，不需要配置密钥文件。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;rndc常用命令：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div></pre></td><td class="code"><pre><div class="line">status <span class="comment">#查看DNS状态</span></div><div class="line">reload <span class="comment">#重新加载配置文件</span></div><div class="line">reload zone_name <span class="comment">#重新加载指定区域</span></div><div class="line">reconfig <span class="comment">#重读配置文件并加载新增的区域</span></div><div class="line">querylog <span class="comment">#关闭或开启查询日志</span></div><div class="line">flush <span class="comment">#清空服务器的缓存</span></div><div class="line">flushname name <span class="comment">#清空指定名称相关的缓存</span></div><div class="line">trace  <span class="comment">#打开debug, debug有级别的概念，每执行一次提升一次级别</span></div><div class="line">trace LEVEL <span class="comment">#指定 debug 的级别, trace 0 表示关闭debug</span></div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;使用rndc：</p>
<ol>
<li>生成密钥文件</li>
</ol>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;命令：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">rndc-confgen &gt; /etc/rndc.conf</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;或者</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">rndc-confgen -r /dev/urandom &gt; /etc/rndc.conf</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;生成的配置文件如下：</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/DNS%E6%9C%8D%E5%8A%A1%E5%99%A8(%E5%9B%9B" alt=""></figure>%EF%BC%9ADNS%E8%A7%86%E5%9B%BE%E5%8F%8Abind%E4%B8%ADrndc%E7%9A%84%E4%BD%BF%E7%94%A8/07.jpeg?raw=true)</p>
<ol>
<li>复制上面配置文件中下面一块被注释的区域至/etc/named.conf文件中，并把注释关闭。</li>
</ol>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/DNS%E6%9C%8D%E5%8A%A1%E5%99%A8(%E5%9B%9B" alt=""></figure>%EF%BC%9ADNS%E8%A7%86%E5%9B%BE%E5%8F%8Abind%E4%B8%ADrndc%E7%9A%84%E4%BD%BF%E7%94%A8/08.jpeg?raw=true)</p>
<ol>
<li>重新加载bind后就可以使用rndc管理bind了。</li>
</ol>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/DNS%E6%9C%8D%E5%8A%A1%E5%99%A8(%E5%9B%9B" alt=""></figure>%EF%BC%9ADNS%E8%A7%86%E5%9B%BE%E5%8F%8Abind%E4%B8%ADrndc%E7%9A%84%E4%BD%BF%E7%94%A8/09.jpeg?raw=true)</p>
<ol>
<li>使用rndc重新加载bind的配置文件。</li>
</ol>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/DNS%E6%9C%8D%E5%8A%A1%E5%99%A8(%E5%9B%9B" alt=""></figure>%EF%BC%9ADNS%E8%A7%86%E5%9B%BE%E5%8F%8Abind%E4%B8%ADrndc%E7%9A%84%E4%BD%BF%E7%94%A8/10.jpeg?raw=true)</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;注意：如果在使用rndc时，出现如上警告时，可以删除/etc/rndc.key文件，或者重命名该文件。</p>
<ol>
<li>DNS服务器的debug功能默认是关闭的，使用rndc trace可以开启该功能，执行一次该命令 debug 级别加一级，也可以在命令后面加一个数字作为参数，指定debug级别，当数字为0时，表示关闭debug功能。</li>
</ol>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;开启debug:</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/DNS%E6%9C%8D%E5%8A%A1%E5%99%A8(%E5%9B%9B" alt=""></figure>%EF%BC%9ADNS%E8%A7%86%E5%9B%BE%E5%8F%8Abind%E4%B8%ADrndc%E7%9A%84%E4%BD%BF%E7%94%A8/11.jpeg?raw=true)</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;关闭debug:</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/DNS%E6%9C%8D%E5%8A%A1%E5%99%A8(%E5%9B%9B" alt=""></figure>%EF%BC%9ADNS%E8%A7%86%E5%9B%BE%E5%8F%8Abind%E4%B8%ADrndc%E7%9A%84%E4%BD%BF%E7%94%A8/12.jpeg?raw=true)</p>

	

	
		<span class="different-posts"><a href="/2017/10/12/Dns、Iredmaill/10. DNS服务器(四)：DNS视图及bind中rndc的使用/" onclick="window.history.go(-1); return false;">⬅️ Go back </a></span>

	

</article>

	</main>

	<footer class="footer">
	<div class="footer-content">
		
	      <div class="footer__element">
	<p>Hi there, <br />welcome to my Blog glad you found it. Have a look around, will you?</p>
</div>

	    
	      <div class="footer__element">
	<h5>Check out</h5>
	<ul class="footer-links">
		<li class="footer-links__link"><a href="/archives">Archive</a></li>
		
		  <li class="footer-links__link"><a href="/atom.xml">RSS</a></li>
	    
		<li class="footer-links__link"><a href="/about">about page</a></li>
		<li class="footer-links__link"><a href="/tags">Tags</a></li>
		<li class="footer-links__link"><a href="/categories">Categories</a></li>
	</ul>
</div>

	    

		<div class="footer-credit">
			<span>© 2017 失落的乐章 | Powered by <a href="https://hexo.io/">Hexo</a> | Theme <a href="https://github.com/HoverBaum/meilidu-hexo">MeiliDu</a></span>
		</div>

	</div>


</footer>



</body>

</html>
